linux-kernel - Re: [PATCH] spi: stm32: fix NULL check on pointer-to-pointer variable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1c6f4024-be8a-4734-a724-f12b85a52ed7@mandelbit.com>
Date: Mon, 30 Jun 2025 09:48:44 +0200
From: Antonio Quartulli <antonio@...delbit.com>
To: Clement LE GOFFIC <clement.legoffic@...s.st.com>,
 linux-spi@...r.kernel.org
Cc: linux-stm32@...md-mailman.stormreply.com,
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
 Alexandre Torgue <alexandre.torgue@...s.st.com>,
 Maxime Coquelin <mcoquelin.stm32@...il.com>, Mark Brown
 <broonie@...nel.org>, Alain Volmat <alain.volmat@...s.st.com>
Subject: Re: [PATCH] spi: stm32: fix NULL check on pointer-to-pointer variable

Hi Clement,

On 30/06/2025 09:34, Clement LE GOFFIC wrote:
> Hi Antonio,
> 
> On 6/28/25 02:02, Antonio Quartulli wrote:
>> In stm32_spi_prepare_rx_dma_mdma_chaining() both rx_dma_desc
>> and rx_mdma_desc are passed as pointer-to-pointer arguments.
>>
>> The goal is to pass back to the caller the value returned
>> by dmaengine_prep_slave_sg(), when it is not NULL.
>>
>> However, the NULL check on the result is erroneously
>> performed without dereferencing the pointer.
>>
>> Add the proper dereference operator to both checks.
>>
>> Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to 
>> enhance DDR use")
>> Addresses-Coverity-ID: 1644715 ("Null pointer dereferences 
>> (REVERSE_INULL)")
>> Signed-off-by: Antonio Quartulli <antonio@...delbit.com>
>> ---
>>   drivers/spi/spi-stm32.c | 6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
>> index 3d20f09f1ae7..e9fa17e52fb0 100644
>> --- a/drivers/spi/spi-stm32.c
>> +++ b/drivers/spi/spi-stm32.c
>> @@ -1529,7 +1529,7 @@ static int 
>> stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
>>                              DMA_PREP_INTERRUPT);
>>       sg_free_table(&dma_sgt);
>> -    if (!rx_dma_desc)
>> +    if (!*rx_dma_desc)
>>           return -EINVAL;
>>       /* Prepare MDMA slave_sg transfer MEM_TO_MEM (SRAM>DDR) */
>> @@ -1563,8 +1563,8 @@ static int 
>> stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
>>                           DMA_PREP_INTERRUPT);
>>       sg_free_table(&mdma_sgt);
>> -    if (!rx_mdma_desc) {
>> -        rx_dma_desc = NULL;
>> +    if (!*rx_mdma_desc) {
>> +        *rx_dma_desc = NULL;
>>           return -EINVAL;
>>       }
> 
> Good catch for both pointers !
> 
> For readability, I would suggest to define two dma_async_tx_descriptor 
> ptr at the beginning of the function such as :
>      struct dma_async_tx_descriptor *_mdma_desc = *rx_mdma_desc;
>      struct dma_async_tx_descriptor *_dma_desc = *rx_dma_desc;
> 
> And then use them all along the function even in the assignation.
> 

Thanks for the comment.
Will send v2!

Regards,


-- 
Antonio Quartulli

CEO and Co-Founder
Mandelbit Srl
https://www.mandelbit.com